Warning: Permanently added '10.128.1.40' (ED25519) to the list of known hosts.
2026/08/08 20:31:55 parsed 1 programs
2026/08/08 20:31:55 serving rpc on tcp://38315
[ 51.510281][ T4199] cgroup: Unknown subsys name 'net'
[ 51.643482][ T4199] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 52.873339][ T4199] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k FS
[ 54.198607][ T4214] chnl_net:caif_netlink_parms(): no params data found
[ 54.236829][ T4214] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.244447][ T4214] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.252217][ T4214] device bridge_slave_0 entered promiscuous mode
[ 54.262914][ T4214] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.270044][ T4214] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.277570][ T4214] device bridge_slave_1 entered promiscuous mode
[ 54.294858][ T4214] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 54.305501][ T4214] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 54.329024][ T4214] team0: Port device team_slave_0 added
[ 54.336169][ T4214] team0: Port device team_slave_1 added
[ 54.350657][ T4214] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 54.357589][ T4214] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 54.383504][ T4214] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 54.395424][ T4214] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 54.402465][ T4214] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 54.428738][ T4214] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 54.457738][ T4214] device hsr_slave_0 entered promiscuous mode
[ 54.465105][ T4214] device hsr_slave_1 entered promiscuous mode
[ 54.539600][ T4214] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 54.551545][ T4214] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 54.560807][ T4214] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 54.569290][ T4214] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 54.586681][ T4214] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.593795][ T4214] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.601461][ T4214] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.608489][ T4214] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 54.644577][ T4214] 8021q: adding VLAN 0 to HW filter on device bond0
[ 54.659253][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 54.668622][ T1278] bridge0: port 1(bridge_slave_0) entered disabled state
[ 54.677290][ T1278] bridge0: port 2(bridge_slave_1) entered disabled state
[ 54.685536][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bond0: link becomes ready
[ 54.698171][ T4214] 8021q: adding VLAN 0 to HW filter on device team0
[ 54.711066][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 54.720090][ T1278] bridge0: port 1(bridge_slave_0) entered blocking state
[ 54.727134][ T1278] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 54.742817][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 54.752418][ T1278] bridge0: port 2(bridge_slave_1) entered blocking state
[ 54.759504][ T1278] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 54.773298][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 54.788171][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 54.796903][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 54.812593][ T4214] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network
[ 54.824198][ T4214] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[ 54.836293][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 54.845874][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 54.859190][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 54.965109][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 54.976234][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 54.988753][ T4214] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 55.011771][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 55.031213][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 55.042240][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 55.050745][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 55.060231][ T4214] device veth0_vlan entered promiscuous mode
[ 55.072417][ T4214] device veth1_vlan entered promiscuous mode
[ 55.095272][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 55.104738][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 55.114100][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 55.127270][ T4214] device veth0_macvtap entered promiscuous mode
[ 55.138253][ T4214] device veth1_macvtap entered promiscuous mode
[ 55.156455][ T4214] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 55.166666][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 55.176759][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 55.190382][ T4214] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 55.201086][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 55.211417][ T4214] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.220413][ T4214] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.230207][ T4214] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.241453][ T4214] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 55.987044][ T144] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 56.576505][ T1278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.586696][ T1278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.597316][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 56.613904][ T9] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 56.621971][ T9] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 56.630567][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 58.653794][ T144] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.794299][ T144] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 60.844863][ T144] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[ 61.906641][ T144] device hsr_slave_0 left promiscuous mode
[ 61.917816][ T144] device hsr_slave_1 left promiscuous mode
[ 61.925797][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[ 61.934150][ T144] batman_adv: batadv0: Removing interface: batadv_slave_0
[ 61.944258][ T144] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[ 61.951851][ T144] batman_adv: batadv0: Removing interface: batadv_slave_1
[ 61.961011][ T144] device bridge_slave_1 left promiscuous mode
[ 61.967788][ T144] bridge0: port 2(bridge_slave_1) entered disabled state
[ 61.995826][ T144] device bridge_slave_0 left promiscuous mode
[ 62.008968][ T144] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.058310][ T144] device veth1_macvtap left promiscuous mode
[ 62.067122][ T144] device veth0_macvtap left promiscuous mode
[ 62.082647][ T144] device veth1_vlan left promiscuous mode
[ 62.098113][ T144] device veth0_vlan left promiscuous mode
2026/08/08 20:32:07 executed programs: 0
[ 62.337670][ T144] team0 (unregistering): Port device team_slave_1 removed
[ 62.348718][ T144] team0 (unregistering): Port device team_slave_0 removed
[ 62.362959][ T144] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface
[ 62.375104][ T144] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface
[ 62.420060][ T144] bond0 (unregistering): Released all slaves
[ 62.650965][ T4339] chnl_net:caif_netlink_parms(): no params data found
[ 62.702238][ T4339] bridge0: port 1(bridge_slave_0) entered blocking state
[ 62.710181][ T4339] bridge0: port 1(bridge_slave_0) entered disabled state
[ 62.718108][ T4339] device bridge_slave_0 entered promiscuous mode
[ 62.741639][ T4339] bridge0: port 2(bridge_slave_1) entered blocking state
[ 62.748692][ T4339] bridge0: port 2(bridge_slave_1) entered disabled state
[ 62.757141][ T4339] device bridge_slave_1 entered promiscuous mode
[ 62.780038][ T4339] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 62.791519][ T4339] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 62.826579][ T4339] team0: Port device team_slave_0 added
[ 62.834295][ T4339] team0: Port device team_slave_1 added
[ 62.854054][ T4339] batman_adv: batadv0: Adding interface: batadv_slave_0
[ 62.861156][ T4339] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 62.887338][ T4339] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[ 62.915866][ T4339] batman_adv: batadv0: Adding interface: batadv_slave_1
[ 62.922917][ T4339] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[ 62.949284][ T4339] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[ 62.982354][ T4339] device hsr_slave_0 entered promiscuous mode
[ 62.989439][ T4339] device hsr_slave_1 entered promiscuous mode
[ 63.507148][ T4339] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 63.517169][ T4339] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 63.545777][ T4339] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 63.561539][ T4339] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 63.647821][ T4339] 8021q: adding VLAN 0 to HW filter on device bond0
[ 63.663440][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
[ 63.675503][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
[ 63.690636][ T4339] 8021q: adding VLAN 0 to HW filter on device team0
[ 63.701150][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
[ 63.711571][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready
[ 63.720300][ T510] bridge0: port 1(bridge_slave_0) entered blocking state
[ 63.727347][ T510] bridge0: port 1(bridge_slave_0) entered forwarding state
[ 63.751615][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready
[ 63.759907][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
[ 63.768510][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready
[ 63.778374][ T510] bridge0: port 2(bridge_slave_1) entered blocking state
[ 63.785468][ T510] bridge0: port 2(bridge_slave_1) entered forwarding state
[ 63.797419][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
[ 63.806422][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
[ 63.816551][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
[ 63.825855][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready
[ 63.845613][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
[ 63.856027][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
[ 63.865026][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready
[ 63.876358][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready
[ 63.885563][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready
[ 63.895377][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready
[ 63.904705][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready
[ 63.918409][ T4339] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready
[ 64.057778][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready
[ 64.068615][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready
[ 64.085294][ T4339] 8021q: adding VLAN 0 to HW filter on device batadv0
[ 64.106582][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready
[ 64.117056][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready
[ 64.146843][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready
[ 64.155733][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready
[ 64.167233][ T4339] device veth0_vlan entered promiscuous mode
[ 64.175062][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready
[ 64.184314][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready
[ 64.201613][ T4339] device veth1_vlan entered promiscuous mode
[ 64.227618][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready
[ 64.240099][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready
[ 64.259515][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready
[ 64.272802][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready
[ 64.287681][ T4339] device veth0_macvtap entered promiscuous mode
[ 64.309948][ T4339] device veth1_macvtap entered promiscuous mode
[ 64.336271][ T4339] batman_adv: batadv0: Interface activated: batadv_slave_0
[ 64.359424][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready
[ 64.370917][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready
[ 64.390545][ T2856] Bluetooth: hci0: command 0x0409 tx timeout
[ 64.402923][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready
[ 64.413194][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready
[ 64.424320][ T4339] batman_adv: batadv0: Interface activated: batadv_slave_1
[ 64.435826][ T4339] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.444964][ T4339] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.454831][ T4339] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.465329][ T4339] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 64.478932][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
[ 64.499836][ T1278] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
[ 64.577530][ T1278] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.591513][ T1278] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.603412][ T510] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 64.642966][ T510] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[ 64.653766][ T510] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[ 64.662311][ T9] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
[ 64.779047][ T4418] svc: failed to register nfsdv3 RPC service (errno 111).
[ 64.789542][ T4418] svc: failed to register nfsaclv3 RPC service (errno 111).
[ 65.051599][ T4339] ==================================================================
[ 65.059823][ T4339] BUG: KASAN: use-after-free in nfsd_shutdown_threads+0x89/0x1a0
[ 65.067559][ T4339] Write of size 4 at addr ffff88801fc9cc50 by task syz-executor/4339
[ 65.075621][ T4339]
[ 65.077952][ T4339] CPU: 1 PID: 4339 Comm: syz-executor Not tainted syzkaller #0
[ 65.085494][ T4339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 65.095551][ T4339] Call Trace:
[ 65.098827][ T4339]
[ 65.101756][ T4339] dump_stack_lvl+0x188/0x250
[ 65.106446][ T4339] ? show_regs_print_info+0x20/0x20
[ 65.111654][ T4339] ? load_image+0x410/0x410
[ 65.116164][ T4339] ? _raw_spin_lock_irqsave+0xbc/0x100
[ 65.121633][ T4339] ? rcu_lock_release+0x5/0x20
[ 65.126403][ T4339] print_address_description+0x60/0x2d0
[ 65.131957][ T4339] ? nfsd_shutdown_threads+0x89/0x1a0
[ 65.137335][ T4339] kasan_report+0xdf/0x130
[ 65.141761][ T4339] ? nfsd_shutdown_threads+0x89/0x1a0
[ 65.147146][ T4339] kasan_check_range+0x235/0x290
[ 65.152091][ T4339] nfsd_shutdown_threads+0x89/0x1a0
[ 65.157295][ T4339] nfsd_umount+0x3e/0xc0
[ 65.161540][ T4339] deactivate_locked_super+0x93/0xf0
[ 65.166835][ T4339] cleanup_mnt+0x426/0x4d0
[ 65.171266][ T4339] task_work_run+0x125/0x1a0
[ 65.175869][ T4339] get_signal+0x123e/0x12e0
[ 65.180382][ T4339] ? task_work_add+0x1a7/0x1d0
[ 65.185163][ T4339] arch_do_signal_or_restart+0xe6/0x12a0
[ 65.190807][ T4339] ? vfs_submount+0xb0/0xb0
[ 65.195326][ T4339] ? path_umount+0x341/0xfe0
[ 65.199925][ T4339] ? get_sigframe_size+0x10/0x10
[ 65.204890][ T4339] ? exit_to_user_mode_loop+0x3b/0x130
[ 65.210357][ T4339] exit_to_user_mode_loop+0x9e/0x130
[ 65.215650][ T4339] exit_to_user_mode_prepare+0xee/0x180
[ 65.221201][ T4339] syscall_exit_to_user_mode+0x16/0x40
[ 65.226667][ T4339] do_syscall_64+0x58/0xa0
[ 65.231084][ T4339] ? clear_bhb_loop+0x30/0x80
[ 65.235760][ T4339] ? clear_bhb_loop+0x30/0x80
[ 65.240440][ T4339] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 65.246346][ T4339] RIP: 0033:0x7f7070c7f317
[ 65.250772][ T4339] Code: a2 c7 05 dc 43 25 00 00 00 00 00 eb 96 e8 e1 12 00 00 90 31 f6 e9 09 00 00 00 66 0f 1f 84 00 00 00 00 00 b8 a6 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 c7 c2 e8 ff ff ff f7 d8 64 89 02 b8
[ 65.270379][ T4339] RSP: 002b:00007ffdcda303f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[ 65.278805][ T4339] RAX: 0000000000000000 RBX: 00007f7070d14474 RCX: 00007f7070c7f317
[ 65.286773][ T4339] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffdcda304b0
[ 65.294743][ T4339] RBP: 00007ffdcda304b0 R08: 00007ffdcda314b0 R09: 00000000ffffffff
[ 65.302718][ T4339] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdcda31540
[ 65.310687][ T4339] R13: 00007f7070d14474 R14: 000000000000fdf3 R15: 00007ffdcda31580
[ 65.318676][ T4339]
[ 65.321691][ T4339]
[ 65.324007][ T4339] Allocated by task 4418:
[ 65.328333][ T4339] __kasan_kmalloc+0xaf/0xe0
[ 65.332927][ T4339] __svc_create+0x60/0x9d0
[ 65.337346][ T4339] svc_create_pooled+0x62f/0x810
[ 65.342282][ T4339] nfsd_create_serv+0x2f9/0x700
[ 65.347138][ T4339] nfsd_svc+0x132/0x9e0
[ 65.351292][ T4339] write_threads+0x2ea/0x350
[ 65.355888][ T4339] nfsctl_transaction_write+0x105/0x150
[ 65.361439][ T4339] vfs_write+0x304/0xd70
[ 65.365682][ T4339] ksys_write+0x153/0x260
[ 65.370014][ T4339] do_syscall_64+0x4c/0xa0
[ 65.374436][ T4339] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 65.380329][ T4339]
[ 65.382648][ T4339] Freed by task 4418:
[ 65.386621][ T4339] kasan_set_track+0x4b/0x70
[ 65.391212][ T4339] kasan_set_free_info+0x1f/0x40
[ 65.396155][ T4339] ____kasan_slab_free+0xd5/0x110
[ 65.401202][ T4339] slab_free_freelist_hook+0xec/0x170
[ 65.406575][ T4339] kfree+0xef/0x2a0
[ 65.410382][ T4339] nfsd_svc+0x7cf/0x9e0
[ 65.414535][ T4339] write_threads+0x2ea/0x350
[ 65.419124][ T4339] nfsctl_transaction_write+0x105/0x150
[ 65.424668][ T4339] vfs_write+0x304/0xd70
[ 65.428911][ T4339] ksys_write+0x153/0x260
[ 65.433237][ T4339] do_syscall_64+0x4c/0xa0
[ 65.437651][ T4339] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 65.443546][ T4339]
[ 65.445866][ T4339] The buggy address belongs to the object at ffff88801fc9cc00
[ 65.445866][ T4339] which belongs to the cache kmalloc-512 of size 512
[ 65.459915][ T4339] The buggy address is located 80 bytes inside of
[ 65.459915][ T4339] 512-byte region [ffff88801fc9cc00, ffff88801fc9ce00)
[ 65.473100][ T4339] The buggy address belongs to the page:
[ 65.478733][ T4339] page:ffffea00007f2700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1fc9c
[ 65.488886][ T4339] head:ffffea00007f2700 order:2 compound_mapcount:0 compound_pincount:0
[ 65.497205][ T4339] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
[ 65.505203][ T4339] raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888016c41c80
[ 65.513787][ T4339] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 65.522361][ T4339] page dumped because: kasan: bad access detected
[ 65.528771][ T4339] page_owner tracks the page as allocated
[ 65.534477][ T4339] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 922, ts 5911659135, free_ts 0
[ 65.552533][ T4339] get_page_from_freelist+0x24f6/0x2670
[ 65.558084][ T4339] __alloc_pages+0x1ee/0x480
[ 65.562679][ T4339] new_slab+0xc0/0x4b0
[ 65.566748][ T4339] ___slab_alloc+0x807/0xdd0
[ 65.571340][ T4339] kmem_cache_alloc_trace+0xf9/0x290
[ 65.576628][ T4339] alloc_bprm+0x56/0x690
[ 65.580868][ T4339] kernel_execve+0x49/0x8e0
[ 65.585371][ T4339] call_usermodehelper_exec_async+0x207/0x350
[ 65.591440][ T4339] ret_from_fork+0x1f/0x30
[ 65.595857][ T4339] page_owner free stack trace missing
[ 65.601220][ T4339]
[ 65.603539][ T4339] Memory state around the buggy address:
[ 65.609162][ T4339] ffff88801fc9cb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 65.617218][ T4339] ffff88801fc9cb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 65.625280][ T4339] >ffff88801fc9cc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 65.633333][ T4339] ^
[ 65.640000][ T4339] ffff88801fc9cc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 65.648060][ T4339] ffff88801fc9cd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 65.656112][ T4339] ==================================================================
[ 65.664168][ T4339] Disabling lock debugging due to kernel taint
[ 65.794927][ T4339] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 65.802141][ T4339] CPU: 0 PID: 4339 Comm: syz-executor Tainted: G B syzkaller #0
[ 65.811071][ T4339] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 65.821116][ T4339] Call Trace:
[ 65.824388][ T4339]
[ 65.827310][ T4339] dump_stack_lvl+0x188/0x250
[ 65.831993][ T4339] ? show_regs_print_info+0x20/0x20
[ 65.837192][ T4339] ? load_image+0x410/0x410
[ 65.841695][ T4339] panic+0x2f8/0x850
[ 65.845588][ T4339] ? bpf_jit_dump+0xd0/0xd0
[ 65.850083][ T4339] ? _raw_spin_unlock_irqrestore+0x10d/0x120
[ 65.856056][ T4339] ? _raw_spin_unlock+0x40/0x40
[ 65.860901][ T4339] ? nfsd_shutdown_threads+0x89/0x1a0
[ 65.866270][ T4339] check_panic_on_warn+0x80/0xa0
[ 65.871208][ T4339] ? nfsd_shutdown_threads+0x89/0x1a0
[ 65.876575][ T4339] end_report+0x6d/0xf0
[ 65.880728][ T4339] kasan_report+0x102/0x130
[ 65.885226][ T4339] ? nfsd_shutdown_threads+0x89/0x1a0
[ 65.890597][ T4339] kasan_check_range+0x235/0x290
[ 65.895530][ T4339] nfsd_shutdown_threads+0x89/0x1a0
[ 65.900720][ T4339] nfsd_umount+0x3e/0xc0
[ 65.904959][ T4339] deactivate_locked_super+0x93/0xf0
[ 65.910239][ T4339] cleanup_mnt+0x426/0x4d0
[ 65.914653][ T4339] task_work_run+0x125/0x1a0
[ 65.919242][ T4339] get_signal+0x123e/0x12e0
[ 65.923743][ T4339] ? task_work_add+0x1a7/0x1d0
[ 65.928508][ T4339] arch_do_signal_or_restart+0xe6/0x12a0
[ 65.934141][ T4339] ? vfs_submount+0xb0/0xb0
[ 65.938645][ T4339] ? path_umount+0x341/0xfe0
[ 65.943231][ T4339] ? get_sigframe_size+0x10/0x10
[ 65.948173][ T4339] ? exit_to_user_mode_loop+0x3b/0x130
[ 65.953625][ T4339] exit_to_user_mode_loop+0x9e/0x130
[ 65.958903][ T4339] exit_to_user_mode_prepare+0xee/0x180
[ 65.964443][ T4339] syscall_exit_to_user_mode+0x16/0x40
[ 65.969906][ T4339] do_syscall_64+0x58/0xa0
[ 65.974313][ T4339] ? clear_bhb_loop+0x30/0x80
[ 65.978982][ T4339] ? clear_bhb_loop+0x30/0x80
[ 65.983656][ T4339] entry_SYSCALL_64_after_hwframe+0x66/0xd0
[ 65.989550][ T4339] RIP: 0033:0x7f7070c7f317
[ 65.993960][ T4339]